[CentOS 7/8] 클라우드 플레어만 서비스 받을 수 있도록 접근 제한

클라우드 플레어를 통해서만 웹 서비스를 제공하기 위해서는 서버로 직접 요청이 오는 것을 차단할 필요가 있다. 본 글에서는 리눅스 방화벽에서 클라우드 플레어 서버만 웹 서비스 제공을 받도록 설정하는 것을 다룬다. 아래의 링크에 가면 클라우드 플레어 서버 IP 주소를 확인할 수 있다. 이 IP 주소를 방화벽 개방 명령어를 입력하여 개방하면 된다.

 

클라우드 플레어 IP 주소 범위 : www.cloudflare.com/ko-kr/ips/

클라우드 플레어 IP 주소 목록

아래의 명령어와 사진처럼 방화벽 개방 명령어를 입력하면 정상적으로 개방 설정이 완료된다.

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="103.21.244.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="103.22.200.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="103.31.4.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="104.16.0.0/13" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="104.24.0.0/14" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="108.162.192.0/18" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="131.0.72.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="141.101.64.0/18" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="162.158.0.0/15" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="172.64.0.0/13" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="173.245.48.0/20" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="188.114.96.0/20" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="190.93.240.0/20" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="197.234.240.0/22" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="198.41.128.0/17" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2400:cb00::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2606:4700::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2803:f800::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2405:b500::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2405:8100::/32" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2a06:98c0::/29" port protocol="tcp" port="443" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv6" source address="2c0f:f248::/32" port protocol="tcp" port="443" accept"
firewall-cmd --reload

방화벽 개방 명령어를 입력한 화면